Privacy Policy

1. Scope of this policy

This Policy describes what information Bassario receives about users of the website, the mobile apps and related services, why it is used, who it may be shared with, how it is protected and what rights the user has. The Policy applies together with the User Agreement, the Terms of Use, the Listing Rules and other Bassario documents.

2. Who processes the data

The operator of the Bassario service is Bassario, an individual entrepreneur registered in Georgia, the owner of the bassario.com domain and of the Bassario mobile apps. A single address is used for enquiries about personal data, accounts, listings, complaints and legal matters: support@bassario.com.

3. Data we collect

The data collected depends on which functions the user uses: browsing listings, signing in with Google or Apple, publishing a listing, messages, internet voice calls, favourites, the map or contacting support. For account security and session management we also record technical session data when signing in: a random device identifier (not a hardware one), information about the browser or app (User-Agent) and a truncated IP address. This data is tied to the session, is available to the user in the «Devices and sessions» section and is stored until the session ends or expires.

• account data: name, email, avatar, Google or Apple account identifier and technical sign-in attributes;
• listing data: description, category, price, currency, address or district, coordinates of the item, characteristics, photos and moderation status;
• communication data: chat messages, time of sending, conversation participants, attachments (photos, videos, audio recordings, voice messages and files), quoted messages in replies, and complaints about correspondence
• internet voice call data: participants, start and end time, duration, status and end reason, and technical connection-quality metrics; the Operator does not record or store call content
• user activity data: favourites, views, search queries, filters, the selected map area, interaction with listings;
• technical data: IP address, request date and time, user agent, device type and OS version, browser, language, app version, screen size and orientation, navigation routes without object identifiers, application errors and crashes, call stacks, the reason for abnormal termination and session identifiers;
• support data: email, the content of the request, attached files, the history of communication and the outcome of the review.
• phone verification data: phone number, country or country code, verification status, selected delivery channel and the time the verification code was sent and checked;
• technical message status marks: sent, delivered, read, and for voice and audio messages also played; such marks are visible to the other party to the correspondence
• support request data: the content of the request, the history of correspondence with the agent, the status and the service quality rating
• push notification tokens and device information necessary to deliver notifications about new messages, incoming calls and significant account events
• calendar and contact data — only if the user connects these functions: the list of connected calendars and the events of calendars set to «Read», and the contacts the user has imported or whose phone address books and Google address books are set to «Read» (see section 8);
• app analytics data: an SDK-generated installation identifier, a service account identifier while signed in, app starts and sessions, event and listing identifiers, the time of permitted actions and sanitised referral-source parameters. Name, email, phone number, message content, contacts, precise location and private screen addresses are not included in analytics event parameters;

4. Data published by users

Listings, photos, the seller's name, the district or address of the item, the price and part of the profile information may be visible to other users, search engines and link preview services. A user must not publish third parties' personal data without a lawful basis or the consent of those persons.

5. How we use data

Bassario processes data only for purposes related to the operation of the marketplace, security, performance of the user documents and user support.

• creating an account, signing in with Google and maintaining the session;
• publishing, searching, displaying and promoting listings;
• operation of the map, listing cards, photo galleries, favourites, chat and internet voice calls;
• moderation of listings, messages, photos and accounts;
• prevention of fraud, spam, duplicates, unlawful content and circumvention of blocks;
• responding to enquiries, handling complaints and disputes between users;
• technical diagnostics, protection of the infrastructure and improvement of service quality;
• compliance with legal requirements and requests from competent authorities, and protection of the rights of Bassario and its users.
• verification of a phone number to protect the account and to counter spam, fraud and abuse;
• displaying the user's own calendars and contacts to the user, synchronising meetings with the «Bassario» calendar and finding Bassario accounts among the user's contacts;
• measuring app starts, sessions and permitted actions, assessing referral sources and improving the product without advertising profiling;

6. Legal bases for processing

Depending on the situation, data is processed on the basis of the acceptance of the user documents, the necessity of providing the service functions, the user's consent, Bassario's legitimate interest in the security and development of the service, and the obligation to comply with applicable law. Mobile app analytics begins when the installed app is first used and also applies in guest mode to the extent described in this Policy. External website analytics is enabled only after a separate choice in Cookie settings. If a different separate consent is required for a particular function, Bassario will request it before such processing begins.

7. Google and Apple Sign-In, third-party services

When signing in with Google or Apple, Bassario receives from the respective provider the data necessary to identify the user: the account identifier, and also the email, name and avatar if the user has allowed them to be shared. Bassario does not receive the password of the Google or Apple account. Apple allows the real email to be hidden and a relay address to be passed to the service — Bassario treats it in the same way as an ordinary email. Yandex.Maps services are used to display maps and to determine an address from coordinates: the map provider may receive technical data necessary for the operation of the map and geocoding. Push notifications are delivered through Firebase Cloud Messaging (Google): a technical device token and the notification text are passed to it. Infrastructure providers process data as Bassario's technical contractors on the Operator's instructions.

8. Calendars and contacts

The Calendar and Contacts functions are optional and are connected only by the user. The user chooses which calendars and address books are read; this data is visible only to that user and is not shown to other users of the service.

• Google Calendar: when the user connects a Google account in the Calendar settings, Bassario receives through the Google Calendar API the list of the user's calendars (name, colour, access level) and, for calendars set to «Read», their events: title, time and time zone, location, description, participants and their responses, reminders, recurrence and links. Bassario does not change these calendars or events.
• the «Bassario» calendar: Bassario creates a separate «Bassario» calendar in the connected Google account and copies the user's Bassario meetings into it; in the «Full» mode it also reads back into Bassario the changes the user makes in that calendar. Switching it to «Disabled» deletes the «Bassario» calendar from the Google account and from the device; the meetings remain in Bassario.
• iPhone calendars: with the user's permission the app reads the calendars on the device and sends to Bassario servers the events of calendars set to «Read», so that they are available on the user's other devices. Events of calendars set to «Disabled» are not sent.
• Google Contacts: when the user connects a Google account in the Contacts settings, Bassario reads the user's contacts through the Google People API (name, organisation, phone numbers, email addresses) and shows them as a separate address book set to «Read». The address book is updated automatically on a schedule and when the user presses the refresh button; in the «Disabled» mode no contacts are read from Google. Bassario does not change or delete contacts in Google. In the app the user can also connect phone address books set to «Read». Contacts are stored in the user's private Bassario address book and are used to find Bassario accounts, to write and to call.
• the Google Calendar access token is stored on Bassario servers in encrypted form and is used only to synchronise the calendars chosen by the user; the Google Contacts access token is also stored on Bassario servers in encrypted form and is used only to read the Google address books the user has connected and to check whether access has been revoked. After access is revoked in the Google account settings the tokens stop working; stored tokens are deleted together with the Bassario account.
• the user can switch any calendar or address book to «Disabled» at any time, revoke Bassario's access in the Google account settings (myaccount.google.com/permissions) or in the device settings.
• Bassario's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google is not used for advertising, is not sold, is not used to train AI models and is not read by people, except with the user's consent, for security purposes or where required by law.

9. Who data may be shared with

Bassario does not sell personal data. Data may be shared only to the extent necessary for the operation of the service, security, support and compliance with the law.

• with users of the service — the public part of a listing and the data needed to make contact about the listing;
• with Google — as part of signing in with Google and verifying the token;
• with Apple — as part of signing in with Apple and verifying the identity token;
• with Google (Firebase Cloud Messaging) — the technical device token and the content of the notification, in order to deliver push messages;
• with Google (Firebase Crashlytics) — technical reports about mobile application errors, crashes and terminations;
• with Google (Google Analytics for Firebase) — app starts, sessions and permitted mobile analytics events;
• with Yandex (AppMetrica) — app starts, sessions and permitted mobile analytics events;
• with Yandex.Maps — to display items and the map;
• with providers of hosting, image storage, the database, monitoring and site delivery;
• with moderators and support staff who need access to perform their task;
• with public authorities or a court — only where this is required by applicable law.
• with technical phone-verification providers, including SMS, Telegram and WhatsApp — the phone number and the necessary technical data, solely to deliver verification codes and operate the verification function;
• with Google — requests to the Google Calendar API and the Google People API on the user's behalf, only after the user has connected these functions;

10. International transfers

The service uses infrastructure and contractors that may be located in different countries. The main computing capacity, the database and the object storage holding listing photos and correspondence attachments are hosted at a provider's site in the European Union (Germany). Individual contractors — the Google and Apple sign-in providers, the push notification service and the mapping service — may process data outside the EU, including in the United States. Transfers take place to the extent necessary to provide the relevant technical service; contractors act on the Operator's instructions and may not use the data received for their own purposes. Where data is transferred to countries that do not provide a comparable level of protection, the Operator relies on the mechanisms provided for by applicable law (including standard contractual clauses) and applies reasonable organisational and technical safeguards.

11. Data retention

Data is stored for as long as necessary for the operation of the service, security, dispute resolution, performance of the user documents and legal requirements. As a rule, the following periods apply:

• account data — while the account exists; after the account is deleted it is, as a rule, deleted or anonymised within 30 days;
• listings — for the period of publication and subsequent storage in the user's archive; deleted listings — as a rule, up to 90 days;
• correspondence and attachments — while the correspondence exists; after a participant's account is deleted — as a rule, up to 90 days, unless a dispute or an investigation requires longer retention;
• support requests and complaint materials — as a rule, up to 24 months from the closure of the request;
• technical and security logs — as a rule, up to 12 months;
• phone verification data — as a rule, up to 12 months from the date of verification;
• Bassario's own analytics event log — as a rule, up to 90 days; retention in external analytics services is governed by the settings of the corresponding resource and the provider's policies;
• calendars and contacts — while the calendar or address book is connected and the account exists; events of a calendar switched to «Disabled» are deleted from Bassario servers immediately, the rest is deleted together with the account;
• data that the Operator is required to retain by law or that is needed to protect rights in a dispute — for the period established by law or the limitation period.

12. Photos and images

User photos are stored in their original form and as smaller technical copies needed to display previews, cards and galleries quickly. Bassario may use technical image deduplication: if the same file has already been processed, the service may refer to the existing copies instead of uploading and processing it again.

13. Media files in correspondence

A user may attach photos, videos, audio recordings, voice messages and arbitrary files to messages. Such attachments are placed in the Operator's object storage and are available solely to the participants in the relevant correspondence via an authorised link; no public access to attachments is provided. The file name, its type and size, and for media files also the duration and frame dimensions, are processed as technical information necessary for correct display. The Operator applies technical deduplication: a cryptographic checksum of the content is calculated for each file, and if a previously uploaded file is sent again the service refers to the already stored object instead of uploading it again. The checksum is used solely to eliminate duplication and is not used to analyse the content of files.

• photos may be downscaled on the user's device before sending in order to save traffic
• attachments are stored while the correspondence exists and are deleted or anonymised together with it in the manner described in the data retention section
• saving a received attachment to a device is done by the user themselves; any further handling of such a file is outside the Operator's control

14. Access to device features

The mobile app requests access to individual device features solely at the moment the user initiates the corresponding action themselves. Access is granted by the user and may be revoked at any time in the operating system settings; revoking access makes only the related function unavailable and does not affect the rest of the service.

• microphone — while recording a voice message and while participating in an internet voice call; during a call, the audio stream is transmitted in real time to the other participant, either directly or through the Operator's secure relay infrastructure. The Operator does not record or store call content; outside voice-message recording or an active call, the microphone is not used and no background recording takes place
• camera and photo gallery — to select or take photos and videos attached to a listing or a message
• file storage — to select a file to send and to save a received attachment at the user's command
• location — to show listings near the selected map area
• notifications — to deliver push messages about new chat messages, incoming calls and significant account events
• calendars — to show events of the calendars the user has set to «Read» and to keep the «Bassario» calendar with the user's meetings on the device; events of calendars set to «Disabled» are not sent to Bassario
• contacts — to connect the phone address books the user has set to «Read»

15. Cookies and similar technologies

The website uses cookies and similar technologies for sign-in, security, maintaining the session and basic interface settings. External web counters are enabled only after a separate choice in Cookie settings. The mobile app uses Google Analytics for Firebase and AppMetrica installation identifiers from the first launch when configured in a production build; advertising identifiers, ad personalisation, precise location and cross-app tracking are disabled for analytics. Further details are set out in the Cookie Policy.

16. Security

Bassario applies technical and organisational protection measures: HTTPS, access segregation, storage of secrets outside public code, security logs, backups and restriction of access by employees and contractors on a need-to-know basis. That said, no internet service can guarantee absolute protection, so users should take care of their account and devices. If a security incident occurs that may create a risk to users' rights, the Operator will notify the affected users within a reasonable period and, where required by applicable law, the competent supervisory authority, describing the nature of the incident, its likely consequences and the measures taken.

17. Staff access to correspondence

Users' correspondence is not public. Access to the content of correspondence is granted to authorised employees of the Operator strictly on a need-to-know basis and only in the following cases: handling a complaint from one of the participants in the correspondence; checking indications of fraud, breaches of the service rules or threats to user security; a user's request to the support service, where reviewing the correspondence is required to handle it; compliance with a mandatory requirement of an authorised body. Employees' actions with user data are recorded in internal logs. The Operator does not use the content of correspondence for advertising purposes and does not share it with third parties, except in the cases expressly provided for by this Policy.

• a support request is handled in a separate conversation with an agent; the support agent has access only to the correspondence relating to that request
• a service quality rating left by the user is processed as internal information about the work of the support service

18. Automated processing and decisions

Some checks in the service are performed automatically: detection of duplicate listings, prohibited language, indications of spam and fraud, and technical format violations. An automated check may result in a listing not being published immediately, being hidden pending manual review, or individual account functions being temporarily restricted.

• decisions that significantly affect the user (refusal to publish, restriction of functions, blocking of an account) are not taken solely automatically: the user may request that they be reviewed by a person;
• the user may state their position and challenge a decision by contacting support@bassario.com; the procedure is described in the Moderation Policy;
• the Operator does not use automated processing for profiling for advertising purposes and does not take decisions on access to third-party services on that basis.

19. User rights

In relation to their personal data, the user has the rights provided for by applicable data protection law. Requests are sent to support@bassario.com; the Operator responds within the period established by applicable law and may ask the user to confirm ownership of the account so that data is not disclosed to an outsider.

• obtain confirmation of processing and a copy of their data (right of access);
• correct inaccurate data or complete incomplete data;
• delete their data and account — in the manner described on the Account and data deletion page;
• restrict processing or object to processing based on the Operator's legitimate interest;
• receive their data in a structured, machine-readable format and, where technically feasible, have it transmitted to another controller (data portability);
• withdraw consent where processing is based on consent; withdrawal does not affect the lawfulness of processing before it was received;
• lodge a complaint with the competent data protection supervisory authority at their place of residence, work or of the alleged infringement.

20. Account and data deletion

An account can be deleted through the app, the website or by a request to support@bassario.com. The detailed procedure is described on the Account and data deletion page. Before deletion, Bassario may ask the user to confirm ownership of the account in order to protect them from unauthorised deletion.

21. Children and age restrictions

Bassario is intended for users over 18 years of age. The service does not knowingly collect children's data. If it becomes known that a minor has provided data or created an account, please write to support@bassario.com — Bassario will take steps to delete such data.

22. Changes to the policy

Bassario may update the Policy. The date of the last update is stated at the top of the page. After a material change, an authenticated user may be asked to accept the new version on the next sign-in; declining ends the authenticated session but does not delete the account or close guest mode. Continuing to use the service in guest mode after the changes take effect means using the service under the updated rules.

23. Contacts

For questions about personal data, account deletion, security, moderation and legal documents, please write to support@bassario.com.